Vets open source packages for vulnerabilities and malicious code before agents add them to a project.
Setup
This project documents no single launch command; follow its repository instructions.
SafeDep vet MCP
SafeDepOfficial
Related
More- BBoost MCPBoostSecurityOfficialChecks packages a coding agent wants to add and blocks dependencies with known vulnerabilities, malware or typosquatting.Security15 Repository stars
- NNPMScanNPMScanOfficialAnalyzes npm packages for vulnerabilities, malicious behavior, suspicious scripts, maintainer risk and typosquatting, without an API key.Security
- AAgentAvowAgentAvowOfficialChecks whether a tool, MCP server, package or skill is safe to connect and returns a signed, verifiable safety grade with reasons.Security5 Repository stars
- CClawSearchClawSearchOfficialSearch engine for AI agent skills with trust scores, multilingual semantic search and supply-chain security checks.Security
- DdepguardmopancPre-install npm package checks: static analysis, supply-chain attack detection, vulnerability audits, hallucinated package guard and CycloneDX SBOM.Security15 Repository stars
- PPinner MCPSafeDepPins GitHub Actions and container base images to immutable SHA hashes to help prevent supply chain attacks.Security13 Repository stars